Most jurisdictions require a property to record who actually stayed, not who made the booking. A four-person party is four records, and a system that captures one is producing a register that is wrong by construction.
Identity is therefore recorded per person on the party — nationality as an ISO code rather than free text, document type alongside document number, and a verification stamp naming who checked it. A number without a type is refused, because a passport number and a national identity number are different identifiers and a register is a register of one of them.
The registration card is a snapshot. It freezes the manifest as it stood when the guest signed, because a signature attests to what was on the page — correcting a document number the next morning must not silently alter a document somebody already signed. Corrections issue a new card linked to the old one.
Capture is deliberately a separate step from check-in. On a four-person party three documents arrive after the room key does, and forcing capture at check-in leaves those three unrecorded exactly as they are today.
Retention is real rather than aspirational: identity documents purge on a configurable window, and the purge sweeps every store that holds them — six of them, including one that keeps a loose filesystem path rather than a media row.